CVE-2026-1056: Snow Monkey Forms WordPress Plugin Arbitrary File Deletion
The Snow Monkey Forms plugin for WordPress has a path validation flaw in its 'generate_user_dirpath' function that allows unauthenticated attackers to delete arbitrary files on the server. The CNA rates it 9.8 (Critical) under CVSS 3.1, and the record notes that deleting critical files such as wp-config.php could lead to remote code execution. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-1056 affects the Snow Monkey Forms plugin for WordPress. According to the record, the 'generate_user_dirpath' function does not validate file paths sufficiently, so a request can cause files outside the intended directory to be deleted. The CNA classifies the weakness as CWE-22 (Path Traversal).
Impact
- Unauthenticated attackers can delete arbitrary files on the server, according to the CNA description.
- Deletion of sensitive files such as wp-config.php could enable remote code execution, as stated in the record.
- The CNA scores the issue 9.8 (Critical) under CVSS 3.1 with a vector indicating high confidentiality, integrity and availability impact and no required privileges or user interaction.
Affected products and versions
- Product: Snow Monkey Forms plugin for WordPress.
- Affected range stated in the description: all versions up to and including 12.0.3.
- The structured affected and fixed fields in the record are empty, so the affected list is taken from the description text only.
- Plugin source references point to tag 12.0.3 in the WordPress plugin repository, see plugin file reference.
Exploitation status
- The CISA KEV catalog entry in the record is marked as not listed, so this analysis does not state that the vulnerability is exploited in the wild.
- No confirmed exploitation appears in the sources consulted.
- The EPSS and SSVC fields are empty in the record.
Remediation and mitigation
- Check the installed version of Snow Monkey Forms and confirm whether it is 12.0.3 or earlier.
- Update the plugin to a release newer than the affected range as soon as the vendor makes one available. The record does not name a fixed version.
- A changeset is referenced at WordPress plugin changeset 3448278, but the record does not state its content, so it should be reviewed before being treated as the fix.
- If an update cannot be applied immediately, consider disabling the plugin until a fixed version is installed, and restrict unnecessary public access to the site.
- Keep verified backups of the site and its configuration files.
Detection guidance
- Review web server and application logs for unexpected requests to the plugin's REST endpoints.
- Monitor for missing or unexpectedly modified files in the WordPress installation, especially configuration files.
- Check file integrity baselines after any suspicious activity on the site.
- Consult the Wordfence threat intelligence entry for further vendor-side context.
Limitations of the available information
- The record does not list a fixed version, so the remediation status of each release is unknown.
- The record does not include a patch description beyond the referenced changeset.
- The exact requests and conditions that trigger the deletion are not described in the record, and this analysis does not provide them.
- No EPSS score is available in the record.
Frequently asked questions
What is CVE-2026-1056?
It is a path validation flaw in the Snow Monkey Forms WordPress plugin that allows unauthenticated attackers to delete arbitrary files on the server, according to the record.
Which versions are affected?
The record states that all versions up to and including 12.0.3 are affected. It does not list a fixed version.
Is this vulnerability known to be exploited?
The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.